TL;DR:

  • Exposed RDP (port 3389) is one of the most common initial access vectors for ransomware — scan your public IP to see if yours is visible before attackers do
  • If you need RDP for remote work, put it behind a VPN or use a Zero Trust tool like Cloudflare Access or Tailscale rather than exposing it directly to the internet
  • If you must expose RDP, enable Network Level Authentication, change the port, restrict source IPs, enforce account lockout policies, and require MFA

Remote Desktop Protocol lets Windows users connect to a computer remotely and use it as if they were sitting in front of it. It’s built into Windows, it works, and it’s been the default remote access method for Windows small business IT for decades. It’s also been consistently among the top three initial access methods for ransomware groups for the past five years running, according to incident response data from multiple security firms.

That’s not because RDP is uniquely broken. It’s because it’s ubiquitous, often misconfigured, and attractive: if you can brute-force RDP credentials or exploit a vulnerability, you land directly on a Windows desktop with whatever access that user has. From there, lateral movement and ransomware deployment can follow in hours.

First: Check Whether Your RDP Is Exposed

Before anything else, find out if your RDP is publicly accessible. Many small businesses think their RDP is “internal only” but actually have it exposed because someone set up port forwarding years ago and forgot.

Check this from outside your network:

  1. Find your public IP address: visit whatismyipaddress.com from inside your office network
  2. Scan port 3389 on that IP: use nmap -p 3389 <your-public-ip> from a machine outside your network, or use an online port scanner like portchecker.co
  3. If port 3389 shows as “open”, your RDP is exposed to the internet

If it’s open, that’s the first thing to fix.

The Right Fix: Stop Exposing RDP Directly

The safest approach is to not have RDP reachable from the internet at all. There are several ways to achieve this:

Tailscale: Install Tailscale on your office machines and your remote workers’ computers. Remote workers connect via Tailscale and then use RDP over the private Tailscale network. RDP never needs to be internet-accessible. Free for up to 3 users, simple to set up.

Cloudflare Access: More complex but enterprise-grade — requires your users to authenticate (with MFA) through Cloudflare before their connection is allowed through to your RDP server. The RDP port is still firewalled; the authentication happens at Cloudflare’s edge before the connection reaches you.

Windows VPN (Always-On or manual): Set up a VPN server (using Windows Server’s Routing and Remote Access, or a dedicated VPN appliance). Require workers to connect to the VPN before using RDP. The RDP server stays behind the firewall.

Any of these is significantly more secure than exposing RDP directly. If you can choose, choose one of these instead of the hardening steps below.

If You Must Keep RDP Exposed: Hardening Steps

Some businesses have a genuine reason to keep RDP internet-accessible (legacy tools that don’t support VPN, single-person IT, specific workflow requirements). If that’s your situation, these steps reduce the risk substantially, though they don’t eliminate it.

Enable Network Level Authentication (NLA): NLA requires users to authenticate before a full RDP session is established. This blocks some classes of vulnerability exploitation that require the session to be set up first. Enable it in System Properties > Remote tab > “Allow connections only from computers running Remote Desktop with Network Level Authentication”.

Change the RDP port: Not security through obscurity alone, but changing from 3389 to a non-standard port reduces automated scanning noise significantly. Most scanners target port 3389; a different port means your server won’t show up in generic scans. Change it via Registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp > PortNumber. Then update your firewall rule to match.

Restrict source IPs: If your remote workers have static home IP addresses or always connect from specific locations, restrict RDP access at the firewall to those IPs only. Even a short IP allowlist drastically reduces your exposure.

Account lockout policy: Configure Windows to lock accounts after 5—10 failed login attempts. This stops brute-force attacks cold. Set it in Group Policy: Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy. Use 5 invalid attempts, 30-minute lockout duration.

Use a dedicated service account: Don’t expose administrator accounts or your primary business accounts via RDP. Create a dedicated account used only for remote access, with the minimum permissions needed.

Enable MFA for RDP: Windows doesn’t natively require MFA for RDP, but third-party tools like Duo Security, Azure AD Multi-Factor Authentication (if you’re on Microsoft 365), or free tools like DUO Free can add it. This is the most impactful security control after moving behind a VPN.

Patch Windows: RDP vulnerabilities (BlueKeep, DejaBlue, PrintNightmare) get patched via Windows Update. Keep Windows fully updated. If you have Windows 7 or Server 2008 machines still accessible via RDP, those are an urgent priority — they are actively exploited.

Monitoring for RDP Attacks

Even with good hardening, monitor for RDP attacks. Check Windows Event Viewer > Windows Logs > Security and look for:

  • Event ID 4625 (failed logon): A stream of these with “Logon Type 3” or “Logon Type 10” and usernames like administrator, admin, test indicates a brute-force attack in progress
  • Event ID 4624 (successful logon) with Logon Type 10 (remote interactive): Review these for unexpected source IPs or times

If you see hundreds of Event 4625 entries from a single IP, add that IP to your firewall block list. If you see many from many IPs, you’ve likely been listed on Shodan or a similar scanner database; blocking the port is the right response.

The bottom line: if RDP is how your team accesses Windows machines remotely, it’s worth spending a couple of hours getting it behind Tailscale or a VPN. The ongoing risk from exposed RDP is too high relative to the effort required to address it.